@learncard/lca-api-service 1.5.1 → 1.5.3

package/dist/routes/ai.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/routes/escrow.d.ts

@@ -28,6 +28,45 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    getAuthorityState: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            nonce: string;
+        };
+        output: {
+            state: {
+                tenant: string;
+                authorityGeneration: string;
+                did: string;
+                enrollmentVersion: number;
+                enrollmentEpoch: number;
+                status: "empty" | "active" | "disabled";
+                envelope: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                } | null;
+                shareVersion: number | null;
+                hasPin: boolean;
+                pinGeneration: number;
+                attemptsUsed: number;
+            };
+            proof: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                payload: string;
+                signature: string;
+                kind: "snapshot";
+            };
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     enroll: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -45,10 +84,56 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
             enclaveKeyId: string;
             pinSalt?: string | undefined;
             clearPin?: boolean | undefined;
+            signedIntent?: {
+                intent: {
+                    version: 2;
+                    tenant: string;
+                    did: string;
+                    authorityGeneration: string;
+                    expectedEnrollmentVersion: number;
+                    action: "enroll" | "replace" | "disable" | "carry";
+                    sourceBlobIdentity: string | null;
+                    targetBlobIdentity: string | null;
+                    pinAction: "set" | "change" | "clear" | "keep";
+                    shareVersion: number;
+                    enrollmentEpoch: number;
+                    requestId: string;
+                    allowRewrap: boolean;
+                    recoveryEmail: string | null;
+                    recoveryLanguage: string | null;
+                };
+                signature: string;
+            } | undefined;
+            sourceEnvelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | null | undefined;
         };
         output: {
             success: true;
             shareVersion: number;
+            envelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | undefined;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -60,6 +145,62 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         output: {
             success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    disable: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            optOut: boolean;
+            signedIntent: {
+                intent: {
+                    version: 2;
+                    tenant: string;
+                    did: string;
+                    authorityGeneration: string;
+                    expectedEnrollmentVersion: number;
+                    action: "enroll" | "replace" | "disable" | "carry";
+                    sourceBlobIdentity: string | null;
+                    targetBlobIdentity: string | null;
+                    pinAction: "set" | "change" | "clear" | "keep";
+                    shareVersion: number;
+                    enrollmentEpoch: number;
+                    requestId: string;
+                    allowRewrap: boolean;
+                    recoveryEmail: string | null;
+                    recoveryLanguage: string | null;
+                };
+                signature: string;
+            };
+            sourceEnvelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | undefined;
+        };
+        output: {
+            success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -89,7 +230,82 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
             releaseAfter: string;
             status: "pending";
             resumeToken: string | null;
+            holdRecord?: {
+                [x: string]: unknown;
+                hold: {
+                    [x: string]: unknown;
+                    holdId: string;
+                    did: string;
+                    shareVersion: number;
+                    blobHash: string;
+                    enrollmentEpoch: number;
+                    releasePolicy: "pin" | "hold";
+                    clientEphemeralPublicKey: string;
+                    createdLo: number;
+                    createdHi: number;
+                    policyVersion: number;
+                    signature: string;
+                };
+                holdDurationMs: number;
+                ledgerSeq: number;
+            } | undefined;
+            requiresConfirmation?: boolean | undefined;
             pinSalt?: string | undefined;
+            codeSent?: boolean | undefined;
+            delivery?: {
+                codeSent: boolean;
+                proof: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    signature: string;
+                    kind: "commit";
+                    payload: string;
+                } | {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    payload: string;
+                    signature: string;
+                    kind: "snapshot";
+                };
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    confirmRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+            code: string;
+        };
+        output: {
+            success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                payload: string;
+                signature: string;
+                kind: "snapshot";
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    resendRecoveryCode: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+        };
+        output: {
+            success: true;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -109,6 +325,27 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
                 releasePolicy: "pin" | "hold";
                 cancelledAt?: string | undefined;
                 completedAt?: string | undefined;
+                requiresConfirmation?: boolean | undefined;
+                confirmed?: boolean | undefined;
+                holdRecord?: {
+                    [x: string]: unknown;
+                    hold: {
+                        [x: string]: unknown;
+                        holdId: string;
+                        did: string;
+                        shareVersion: number;
+                        blobHash: string;
+                        enrollmentEpoch: number;
+                        releasePolicy: "pin" | "hold";
+                        clientEphemeralPublicKey: string;
+                        createdLo: number;
+                        createdHi: number;
+                        policyVersion: number;
+                        signature: string;
+                    };
+                    holdDurationMs: number;
+                    ledgerSeq: number;
+                } | undefined;
             } | null;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;

package/dist/routes/index.d.ts

@@ -35,6 +35,7 @@ export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMe
 export declare const createContext: (options: CreateAWSLambdaContextOptions<APIGatewayProxyEventV2> | CreateFastifyContextOptions | NodeHTTPCreateContextFnOptions<IncomingMessage, ServerResponse>) => Promise<Context>;
 export declare const redactSecretFields: (value: unknown, depth?: number, seen?: Set<object>) => unknown;
 export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -42,11 +43,11 @@ export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Cont
         authorizedDid?: boolean;
     } | undefined;
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -54,11 +55,11 @@ export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Conte
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -66,11 +67,11 @@ export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBui
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -78,7 +79,6 @@ export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureB
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;

package/dist/routes/keys.d.ts

@@ -67,6 +67,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 attemptsRemaining: number;
                 salt?: string | undefined;
             };
+            primaryDid: string | null;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -152,7 +153,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 attemptsRemaining: number;
                 salt?: string | undefined;
             };
-            sssActivationState: "provisional" | "active";
+            sssActivationState: "active" | "provisional";
             escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
         } | null;
         meta: import("trpc-to-openapi").OpenApiMeta;

package/dist/services/escrow-enclave/authorityContract.d.ts

@@ -0,0 +1,170 @@
+import { z } from 'zod';
+export declare const safeInteger: z.ZodNumber;
+export declare const AuthorityEnvelopeValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    iv: z.ZodString;
+    ciphertext: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityRecordValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodEnum<{
+        proposal: "proposal";
+        commit: "commit";
+        snapshot: "snapshot";
+    }>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityCommitValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"commit">;
+    payload: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityHoldSnapshotValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>;
+export declare const AuthorityHoldReceiptValidator: z.ZodUnion<readonly [z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"commit">;
+    payload: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>]>;
+export declare const SignedEnrollmentIntentValidator: z.ZodObject<{
+    intent: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        tenant: z.ZodString;
+        did: z.ZodString;
+        authorityGeneration: z.ZodString;
+        expectedEnrollmentVersion: z.ZodNumber;
+        action: z.ZodEnum<{
+            enroll: "enroll";
+            replace: "replace";
+            disable: "disable";
+            carry: "carry";
+        }>;
+        sourceBlobIdentity: z.ZodNullable<z.ZodString>;
+        targetBlobIdentity: z.ZodNullable<z.ZodString>;
+        pinAction: z.ZodEnum<{
+            set: "set";
+            change: "change";
+            clear: "clear";
+            keep: "keep";
+        }>;
+        shareVersion: z.ZodNumber;
+        enrollmentEpoch: z.ZodNumber;
+        requestId: z.ZodString;
+        allowRewrap: z.ZodBoolean;
+        recoveryEmail: z.ZodNullable<z.ZodString>;
+        recoveryLanguage: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityStateValidator: z.ZodObject<{
+    tenant: z.ZodString;
+    authorityGeneration: z.ZodString;
+    did: z.ZodString;
+    enrollmentVersion: z.ZodNumber;
+    enrollmentEpoch: z.ZodNumber;
+    status: z.ZodEnum<{
+        empty: "empty";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    envelope: z.ZodNullable<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
+    shareVersion: z.ZodNullable<z.ZodNumber>;
+    hasPin: z.ZodBoolean;
+    pinGeneration: z.ZodNumber;
+    attemptsUsed: z.ZodNumber;
+}, z.core.$strict>;
+export declare const AuthorityStateResponseValidator: z.ZodObject<{
+    state: z.ZodObject<{
+        tenant: z.ZodString;
+        authorityGeneration: z.ZodString;
+        did: z.ZodString;
+        enrollmentVersion: z.ZodNumber;
+        enrollmentEpoch: z.ZodNumber;
+        status: z.ZodEnum<{
+            empty: "empty";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        envelope: z.ZodNullable<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>>;
+        shareVersion: z.ZodNullable<z.ZodNumber>;
+        hasPin: z.ZodBoolean;
+        pinGeneration: z.ZodNumber;
+        attemptsUsed: z.ZodNumber;
+    }, z.core.$strict>;
+    proof: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        payload: z.ZodString;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"snapshot">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const AuthorityMutationValidator: z.ZodObject<{
+    envelope: z.ZodNullable<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
+    receipt: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"commit">;
+        payload: z.ZodString;
+    }, z.core.$strict>;
+    authorityGeneration: z.ZodString;
+    enrollmentVersion: z.ZodNumber;
+    enrollmentEpoch: z.ZodNumber;
+}, z.core.$strict>;
+export type AuthorityRecord = z.infer<typeof AuthorityRecordValidator>;
+export type AuthorityHoldReceipt = z.infer<typeof AuthorityHoldReceiptValidator>;
+export type AuthorityMutationResult = z.infer<typeof AuthorityMutationValidator>;
+export type AuthorityStateResponse = z.infer<typeof AuthorityStateResponseValidator>;

package/dist/services/escrow-enclave/logFailure.d.ts

@@ -0,0 +1 @@
+export declare const logEscrowFailure: (error: unknown) => void;

package/dist/services/escrow-enclave/logFailure.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/types.d.ts

@@ -1,4 +1,10 @@
-import type { EscrowEnvelope } from '@learncard/sss-key-manager';
+import type { EscrowEnvelope, SignedEscrowEnrollmentIntent } from '@learncard/sss-key-manager';
+import type { AuthorityRecord, AuthorityHoldReceipt, AuthorityMutationResult, AuthorityStateResponse } from './authorityContract';
+export interface ApplyEnrollmentInput {
+    signedIntent: SignedEscrowEnrollmentIntent;
+    sourceEnvelope: EscrowEnvelope | null;
+    targetEnvelope: EscrowEnvelope | null;
+}
 export interface EnclaveAttestation {
     mode: 'software' | 'nitro';
     keyId: string;
@@ -42,11 +48,21 @@ export interface EnclaveCreateHoldInput {
     clientEphemeralPublicKey: string;
 }
 export interface CancelHoldRequest {
+    requestId?: string;
     envelope: EscrowEnvelope;
     hold: EscrowHoldRecord;
     clientEphemeralPublicKey: string;
     expectedDid: string;
 }
+export interface ConfirmHoldRequest extends CancelHoldRequest {
+    code: string;
+}
+export type ResendCodeRequest = CancelHoldRequest;
+export interface SendReleaseWarningRequest {
+    requestId?: string;
+    holdId: string;
+    expectedDid: string;
+}
 export interface VerifyEscrowBlobInput {
     envelope: EscrowEnvelope;
     expectedDid: string;
@@ -66,6 +82,7 @@ export interface ReleaseRequest extends CancelHoldRequest {
 }
 export interface ReleaseResult {
     sealed: EscrowEnvelope;
+    receipt?: AuthorityRecord;
 }
 export interface CarryPinVerifierInput {
     sourceEnvelope: EscrowEnvelope;
@@ -83,6 +100,11 @@ export interface RewrapEscrowBlobInput {
     sourceEnrollmentEpoch: number;
 }
 export interface EscrowEnclave {
+    getEnrollmentState?(input: {
+        expectedDid: string;
+        nonce: string;
+    }): Promise<AuthorityStateResponse>;
+    applyEnrollmentIntent?(input: ApplyEnrollmentInput): Promise<AuthorityMutationResult>;
     getAttestation(nonce?: Uint8Array): Promise<EnclaveAttestation>;
     verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
     carryPinVerifier(input: CarryPinVerifierInput): Promise<{
@@ -90,16 +112,45 @@ export interface EscrowEnclave {
     }>;
     rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
         envelope: EscrowEnvelope;
+        authority?: AuthorityMutationResult;
     }>;
     releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
     createHold(input: EnclaveCreateHoldInput): Promise<{
         holdRecord: EscrowHoldRecord;
+        delivery?: {
+            codeSent: boolean;
+            proof: AuthorityHoldReceipt;
+        };
+    }>;
+    getHoldState?(input: {
+        expectedDid: string;
+        hold: EscrowHoldRecord;
+        nonce: string;
+    }): Promise<{
+        proof: AuthorityRecord;
+    }>;
+    cancelHold(input: CancelHoldRequest): Promise<void | {
+        receipt: AuthorityRecord;
+    }>;
+    confirmHold?(input: ConfirmHoldRequest): Promise<{
+        receipt: AuthorityHoldReceipt;
+        confirmedAtMs: number;
+    }>;
+    resendCode?(input: ResendCodeRequest): Promise<{
+        receipt: AuthorityRecord;
+    }>;
+    sendReleaseWarning?(input: SendReleaseWarningRequest): Promise<{
+        receipt: AuthorityHoldReceipt;
+        releaseWarningSentAtMs: number;
     }>;
-    cancelHold(input: CancelHoldRequest): Promise<void>;
 }
 export declare class EscrowPolicyError extends Error {
     constructor();
 }
+export declare class EscrowCodeError extends Error {
+    readonly reason: 'codeMismatch' | 'codeExpired' | 'codeLocked';
+    constructor(reason: 'codeMismatch' | 'codeExpired' | 'codeLocked');
+}
 export declare class EscrowPinMismatchError extends Error {
     constructor();
 }
@@ -107,5 +158,6 @@ export declare class EscrowBlobError extends Error {
     constructor();
 }
 export declare class EscrowUnavailableError extends Error {
-    constructor();
+    readonly reason: 'unavailable' | 'ledger' | 'time' | 'transport' | 'invalid_response' | 'invalid_hold' | 'http_refusal' | 'rate_limit';
+    constructor(reason?: 'unavailable' | 'ledger' | 'time' | 'transport' | 'invalid_response' | 'invalid_hold' | 'http_refusal' | 'rate_limit');
 }

package/esbuildPlugins.cjs

@@ -2,6 +2,7 @@ const path = require('node:path');
 const fs = require('node:fs');
 
 const { sentryEsbuildPlugin } = require('@sentry/esbuild-plugin');
+const { withSentryRateLimitRetry } = require('../../../scripts/sentry-rate-limit-retry.cjs');
 
 const forceCjsSodiumWrapperPlugin = {
     name: 'force-cjs-sodium-wrapper',
@@ -40,10 +41,12 @@ const copyDidkitWasmPlugin = {
 module.exports = [
     forceCjsSodiumWrapperPlugin,
     copyDidkitWasmPlugin,
-    sentryEsbuildPlugin({
-        telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
-        authToken: process.env.SENTRY_AUTH_TOKEN,
-        org: process.env.SENTRY_ORG,
-        project: process.env.SENTRY_PROJECT,
-    }),
+    withSentryRateLimitRetry(
+        sentryEsbuildPlugin({
+            telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
+            authToken: process.env.SENTRY_AUTH_TOKEN,
+            org: process.env.SENTRY_ORG,
+            project: process.env.SENTRY_PROJECT,
+        })
+    ),
 ];